CVE-2026-98475

A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresses. When extended format channel measurement data is recorded on systems using randomized memory configurations, the kernel fails to properly translate the target memory address before providing it to the system firmware. Consequently, the firmware writes measurement data into unintended physical memory locations, which can destabilize the system or result in a crash.

An address space confusion in s390 channel measurement handling can pass a virtual measurement block address to firmware as an absolute DMA address. On kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE, firmware may therefore store extended channel measurement data at an unintended physical address. Depending on firmware address validation and the resulting location, this may cause measurement failure, corruption of unrelated physical memory, a kernel crash, or loss of system availability. The issue is local, specific to affected s390 configurations, and is not directly network reachable. For the CVSS the PR:H is selected because activating or configuring channel measurement blocks normally requires administrative control over the channel subsystem. The base score represents limited integrity impact and high availability impact from a wrong firmware write. The paranoid score treats the unintended physical memory write as a potential strong kernel memory corruption primitive, although reliable attacker control over the destination and contents is not established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.